diff --git a/openid-connect-server-webapp/src/main/webapp/WEB-INF/user-context.xml b/openid-connect-server-webapp/src/main/webapp/WEB-INF/user-context.xml index 87b5768d1..c78e89954 100644 --- a/openid-connect-server-webapp/src/main/webapp/WEB-INF/user-context.xml +++ b/openid-connect-server-webapp/src/main/webapp/WEB-INF/user-context.xml @@ -44,7 +44,7 @@ - + diff --git a/openid-connect-server-webapp/src/main/webapp/WEB-INF/views/login.jsp b/openid-connect-server-webapp/src/main/webapp/WEB-INF/views/login.jsp index 5a15629e9..7852805aa 100644 --- a/openid-connect-server-webapp/src/main/webapp/WEB-INF/views/login.jsp +++ b/openid-connect-server-webapp/src/main/webapp/WEB-INF/views/login.jsp @@ -6,7 +6,8 @@ @@ -29,7 +30,7 @@ $(document).ready(function() {
- + " id="j_username" name="j_username">
diff --git a/openid-connect-server/src/main/java/org/mitre/openid/connect/ConnectOAuth2RequestFactory.java b/openid-connect-server/src/main/java/org/mitre/openid/connect/ConnectOAuth2RequestFactory.java index 37f68798e..7deac6380 100644 --- a/openid-connect-server/src/main/java/org/mitre/openid/connect/ConnectOAuth2RequestFactory.java +++ b/openid-connect-server/src/main/java/org/mitre/openid/connect/ConnectOAuth2RequestFactory.java @@ -117,11 +117,15 @@ public class ConnectOAuth2RequestFactory extends DefaultOAuth2RequestFactory { request.getExtensions().put("max_age", inputParams.get("max_age")); } + if (inputParams.containsKey("login_hint")) { + request.getExtensions().put("login_hint", inputParams.get("login_hint")); + } + if (inputParams.containsKey("request")) { request.getExtensions().put("request", inputParams.get("request")); processRequestObject(inputParams.get("request"), request); } - + if (request.getClientId() != null) { try { ClientDetailsEntity client = clientDetailsService.loadClientByClientId(request.getClientId()); @@ -348,6 +352,14 @@ public class ConnectOAuth2RequestFactory extends DefaultOAuth2RequestFactory { // we save the string because the object might not be a Java Serializable, and we can parse it easily enough anyway request.getExtensions().put("claims", claimRequest.toString()); } + + String loginHint = claims.getStringClaim("login_hint"); + if (loginHint != null) { + if (!loginHint.equals(request.getExtensions().get("login_hint"))) { + logger.info("Mistmatch between request object and regular parameter for login_hint, using requst object"); + } + request.getExtensions().put("login_hint", loginHint); + } } catch (ParseException e) { logger.error("ParseException while parsing RequestObject:", e); diff --git a/openid-connect-server/src/main/java/org/mitre/openid/connect/filter/PromptFilter.java b/openid-connect-server/src/main/java/org/mitre/openid/connect/filter/AuthorizationRequestFilter.java similarity index 93% rename from openid-connect-server/src/main/java/org/mitre/openid/connect/filter/PromptFilter.java rename to openid-connect-server/src/main/java/org/mitre/openid/connect/filter/AuthorizationRequestFilter.java index 23da6f8aa..564e8c9cc 100644 --- a/openid-connect-server/src/main/java/org/mitre/openid/connect/filter/PromptFilter.java +++ b/openid-connect-server/src/main/java/org/mitre/openid/connect/filter/AuthorizationRequestFilter.java @@ -54,10 +54,10 @@ import com.google.common.base.Strings; * @author jricher * */ -@Component("promptFilter") -public class PromptFilter extends GenericFilterBean { +@Component("authRequestFilter") +public class AuthorizationRequestFilter extends GenericFilterBean { - private Logger logger = LoggerFactory.getLogger(PromptFilter.class); + private Logger logger = LoggerFactory.getLogger(AuthorizationRequestFilter.class); public final static String PROMPTED = "PROMPT_FILTER_PROMPTED"; public final static String PROMPT_REQUESTED = "PROMPT_FILTER_REQUESTED"; @@ -76,6 +76,7 @@ public class PromptFilter extends GenericFilterBean { HttpServletRequest request = (HttpServletRequest) req; HttpServletResponse response = (HttpServletResponse) res; + HttpSession session = request.getSession(); // skip everything that's not an authorize URL if (!request.getServletPath().startsWith("/authorize")) { @@ -96,6 +97,15 @@ public class PromptFilter extends GenericFilterBean { // no need to worry about this here, it would be caught elsewhere } + + // save the login hint to the session + if (authRequest.getExtensions().get("login_hint") != null) { + session.setAttribute("login_hint", authRequest.getExtensions().get("login_hint")); + } else { + session.removeAttribute("login_hint"); + } + + if (authRequest.getExtensions().get("prompt") != null) { // we have a "prompt" parameter String prompt = (String)authRequest.getExtensions().get("prompt"); @@ -119,7 +129,6 @@ public class PromptFilter extends GenericFilterBean { } else if (prompts.contains("login")) { // first see if the user's already been prompted in this session - HttpSession session = request.getSession(); if (session.getAttribute(PROMPTED) == null) { // user hasn't been PROMPTED yet, we need to check @@ -160,7 +169,6 @@ public class PromptFilter extends GenericFilterBean { if (max != null) { - HttpSession session = request.getSession(); Date authTime = (Date) session.getAttribute(AuthenticationTimeStamper.AUTH_TIMESTAMP); Date now = new Date(); diff --git a/openid-connect-server/src/main/java/org/mitre/openid/connect/web/AuthenticationTimeStamper.java b/openid-connect-server/src/main/java/org/mitre/openid/connect/web/AuthenticationTimeStamper.java index 6c8f143e9..1f801db08 100644 --- a/openid-connect-server/src/main/java/org/mitre/openid/connect/web/AuthenticationTimeStamper.java +++ b/openid-connect-server/src/main/java/org/mitre/openid/connect/web/AuthenticationTimeStamper.java @@ -27,7 +27,7 @@ import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import javax.servlet.http.HttpSession; -import org.mitre.openid.connect.filter.PromptFilter; +import org.mitre.openid.connect.filter.AuthorizationRequestFilter; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.security.core.Authentication; @@ -62,9 +62,9 @@ public class AuthenticationTimeStamper extends SavedRequestAwareAuthenticationSu session.setAttribute(AUTH_TIMESTAMP, authTimestamp); - if (session.getAttribute(PromptFilter.PROMPT_REQUESTED) != null) { - session.setAttribute(PromptFilter.PROMPTED, Boolean.TRUE); - session.removeAttribute(PromptFilter.PROMPT_REQUESTED); + if (session.getAttribute(AuthorizationRequestFilter.PROMPT_REQUESTED) != null) { + session.setAttribute(AuthorizationRequestFilter.PROMPTED, Boolean.TRUE); + session.removeAttribute(AuthorizationRequestFilter.PROMPT_REQUESTED); } logger.info("Successful Authentication of " + authentication.getName() + " at " + authTimestamp.toString());